Get macfor Pro

Pro plugin

Google Chrome Browser

Collects Chrome browsing history, downloads, bookmarks, cookies, autofill, extensions, local storage, and sessions

browser.chromePromacOS 10.12+v1.0.0browseruserweb

Run this plugin

Trigger collection for Google Chrome Browser on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin browser.chrome --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin browser.chrome --dry-run

Compatibility

  • macOS 10.12+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (10 collected, 9 planned)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

Path placeholders

  • {variant_path} is each installed variant's data directory:
    • Google Chrome — Library/Application Support/Google/Chrome
    • Google Chrome Canary — Library/Application Support/Google/Chrome Canary
    • Chromium — Library/Application Support/Chromium
  • {profile} is Default and every Profile * directory.

history

ArtifactFormatPathNotes
Browsing History
history
sqlite~/{variant_path}/{profile}/History—
Top Sites
top_sitesPlanned — not collected yetOptional
sqlite~/{variant_path}/{profile}/Top Sites—
Omnibox Shortcuts
shortcutsPlanned — not collected yetOptional
sqlite~/{variant_path}/{profile}/Shortcuts—
Network Action Predictor
network_action_predictorPlanned — not collected yetOptional
sqlite~/{variant_path}/{profile}/Network Action Predictor—
Media History
media_historyPlanned — not collected yetOptional
sqlite~/{variant_path}/{profile}/Media History—

downloads

ArtifactFormatPathNotes
Downloads
downloads
sqlite~/{variant_path}/{profile}/HistoryTables: downloads, downloads_url_chains

bookmarks

ArtifactFormatPathNotes
Bookmarks
bookmarks
json~/{variant_path}/{profile}/Bookmarks—

cookies

ArtifactFormatPathNotes
Cookies
cookiesOptionalSensitive
sqlite~/{variant_path}/{profile}/Cookies—

credentials

ArtifactFormatPathNotes
Login Data
login_dataOptionalSensitive
sqlite~/{variant_path}/{profile}/Login Data—

autofill

ArtifactFormatPathNotes
Web Data (Autofill)
web_dataOptionalSensitive
sqlite~/{variant_path}/{profile}/Web Data—

extensions

ArtifactFormatPathNotes
Extensions
extensionsOptional
directory~/{variant_path}/{profile}/Extensions/*—

storage

ArtifactFormatPathNotes
Local Storage
local_storageOptional
leveldb~/{variant_path}/{profile}/Local Storage/leveldb—
Session Storage
session_storagePlanned — not collected yetOptional
leveldb~/{variant_path}/{profile}/Session Storage—
IndexedDB
indexeddbPlanned — not collected yetOptional
leveldb~/{variant_path}/{profile}/IndexedDB/*—

session

ArtifactFormatPathNotes
Session Files
sessionsOptional
snss~/{variant_path}/{profile}/Current Session
+3 more
  • ~/{variant_path}/{profile}/Current Tabs
  • ~/{variant_path}/{profile}/Last Session
  • ~/{variant_path}/{profile}/Last Tabs
—

config

ArtifactFormatPathNotes
Preferences
preferencesOptional
json~/{variant_path}/{profile}/Preferences—

cache

ArtifactFormatPathNotes
Favicon Cache
faviconsPlanned — not collected yetOptionallow value
sqlite~/{variant_path}/{profile}/Favicons—
Browser Cache
cachePlanned — not collected yetOptionalmedium value
directory~/{variant_path}/{profile}/Cache/Cache_Data—
GPU Cache
gpu_cachePlanned — not collected yetOptionallow value
directory~/{variant_path}/{profile}/GPUCache—